Description
In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve: https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L37-L39
loadCompressedPublicKey is, however, missing that check: https://github.
Recommendation
Update the secp256k1 package to the latest compatible version. Followings are version details:
Affected version(s): **<= 3.8.0 >= 4.0.0, < 4.0.4 = 5.0.0** Patched version(s): **3.8.1 4.0.4 5.0.1**
References
Could your website be exposed too?
SmartScanner can check your website for secp256k1-node allows private key extraction over ECDH and gives you actionable findings to investigate.
Start a free scanRelated Issues
- tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir - CVE-2024-49364
- tiny-secp256k1 allows for verify() bypass when running in bundled environment - CVE-2024-49365
- jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation - CVE-2026-4599
- jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction - CVE-2026-4601
You might also like:
See something that needs correcting? Let us knowUpdated October 21, 2024